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The European Data Protection Board 


Having regard to Article 70 (1)(e) of the Regulation 2016/679/EU of the European Parliament and of 
the Council of 27 April 2016 on the protection of natural persons with regard to the processing of 
personal data and on the free movement of such data, and repealing Directive 95/46/EC, (hereinafter 
“GDPR’), 


Having regard to the EEA Agreement and in particular to Annex XI and Protocol 37 thereof, as amended 
by the Decision of the EEA joint Committee No 154/2018 of 6 July 2018?, 


Having regard to Article 12 and Article 22 of its Rules of Procedure, 


HAS ADOPTED THE FOLLOWING GUIDELINES 


INTRODUCTION 


Following the Costeja judgment of the Court of Justice of the European Union (“CJEU”) of the 13th of 
May 20147, a data subject may request the provider of an online search engine (“search engine 
provider”)?, to erase one or more links to web pages from the list of results displayed following a search 
made on the basis of his or her name. 


According to Google’s Transparency Report’, the percentage of URLs that Google has not delisted has 
not increased over the past 5 years since that judgement. However, further to the CJEU judgement, 
data subjects seem to be more aware of their right to lodge a complaint for refusals of their delisting 
requests since Supervisory Authorities have observed an increase in the number of complaints 
regarding the refusal by search engine providers to delist links. 


The European Data Protection Board (the “EDPB”), in accordance with its Action Plan, is developing 
guidelines in respect of Article 17 of the General Data Protection Regulation (“GDPR”). Until those 
guidelines are finalised, Supervisory Authorities must continue to handle and investigate, to the extent 
possible, complaints from data subjects and in a timely manner as possible. 


Accordingly, this document aims to interpret the Right to be Forgotten in the search engines cases in 
light of the provisions of Article 17 GDPR (the “Right to request delisting”). Indeed, the Right to be 
Forgotten has been especially enacted under Article 17 GDPR to take into account the Right to request 
delisting established in the Costeja judgement. 


Nonetheless, as under the Directive 95/46/EC of 24 October 1995 (the “Directive”) and as stated by 
the CJEU in its aforementioned Costeja judgement’, the Right to request delisting implies two rights 


1 References to “Member States” made throughout these guidelines should be understood as references to “EEA Member 
States”. 

2 CJEU, Case C-131/12, Google Spain SL and Google Inc. v Agencia Española de Protección de Datos (AEPD) and Mario Costeja 
Gonzalez, judgment of 13 May 2014. 

3 including web archives such as archive.org 

4 https://transparencyreport.google.com/eu-privacy/overview?hl=en 

5 CJEU, Case C-131/12, judgment of 13 May 2014, paragraph 88: “Article 12(b) and subparagraph (a) of the first paragraph of 
Article 14 of Directive 95/46 are to be interpreted as meaning that, in order to comply with the rights laid down in those 
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(Right to Object and Right to Erasure GDPR). Indeed, the application of Article 21 is expressly foreseen 
as the third ground for the Right to erasure. As a result, both Article 17 and Article 21 GDPR can serve 
as a legal basis for delisting requests. The right to object and the right to obtain erasure were already 
granted under the Directive. Nonetheless, as it will be addressed, the wording of the GDPR requires an 
adjustment of the interpretation of these rights. 


As a preliminary point, it should be noted that, while Article 17 GDPR is applicable to all data 
controllers, this paper focuses solely on processing by search engine providers and delisting requests 
submitted by data subjects. 


There are some considerations when applying Article 17 GDPR in respect of a search engine provider's 
data processing. In this regard, it is necessary to state that the processing of personal data carried out 
in the context of the activity of the search engine provider must be distinguished from processing that 
is carried out by the publishers of the third-party websites such as media outlets that provide online 
newspaper content®. 


If a data subject obtains the delisting of a particular content, this will result in the deletion of that 
specific content from the list of search results concerning the data subject when the search is, as a 
main rule, based on his or her name. This content will however still be available using other search 
criteria. 


Delisting requests do not result in the personal data being completely erased. Indeed, the personal 
data will neither be erased from the source website nor from the index and cache of the search engine 
provider. For example, a data subject may seek the delisting of personal data from a search engine’s 
index which have originated from a media outlet, such as a newspaper article. In this instance, the link 
to the personal data may be delisted from the search engine’s index; however, the article in question 
will still remain within the control of the media outlet and may remain publicly available and accessible, 
even if no longer visible in search results based on queries that include in principle the data subject’s 
name. 


Nevertheless, search engine providers are not exempt in a general manner from the duty to fully erase. 
In some exceptional cases, they will need to carry out actual and full erasure in their indexes or caches. 
For example, in the event that search engine providers would stop respecting robots.txt requests 
implemented by the original publisher, they would actually have a duty to fully erase the URL to the 
content, as opposed to delist which is mainly based on data subject’s name. 


This paper is divided into two topics. The first topic concerns the grounds a data subject can rely on for 
a delisting request sent to a search engine provider pursuant to Article 17.1 GDPR. The second topic 
concerns the exceptions to the Right to request delisting according to Article 17.3 GDPR. This paper 
will be supplemented by an appendix dedicated to the assessment of criteria for handling complaints 
for refusals of delisting. 


provisions and in so far as the conditions laid down by those provisions are in fact satisfied, the operator of a search engine is 
obliged to remove from the list of results displayed following a search made on the basis of a person’s name links to web 
pages, published by third parties and containing information relating to that person, also in a case where that name or 
information is not erased beforehand or simultaneously from those web pages, and even, as the case may be, when its 
publication in itself on those pages is lawful”. 

6 CJEU, Case C 131/12, judgment of 13 May 2014; European Court of Human Rights (ECHR), “M.L. and W.W. vs Germany”, 28 
June 2018. 
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This paper does not address Article 17.2” GDPR. Indeed, this Article requires data controllers who have 
made the personal data public to inform controllers who have then reused those personal data 
through links, copies or replications. Such obligation of information does not apply to search engine 
providers when they find information containing personal data published or placed on the internet by 
third parties, index it automatically, store it temporarily and make it available to internet users 
according to a particular order of preference’. In addition, it does not require search engine providers, 
who have received a data subject’s delisting request, to inform the third party which made public that 
information on the internet. Such obligation seeks to give greater responsibility to original controllers 
and try to prevent from multiplying data subjects’ initiatives. In this regard, the statement by the 
Article 29 Working Party, saying that search engine providers “should not as a general practice inform 
the webmasters of the pages affected by de-listing of the fact that some webpages cannot be acceded 
from the search engine in response to specific queries” because “such communication has no legal basis 
under EU data protection law”? remains valid. It is also planned to have separate specific guidelines in 
respect of Article 17.2 GDPR. 


1 THE GROUNDS OF THE RIGHT TO REQUEST DELISTING UNDER 
GDPR 


The Right to request delisting as provided by Article 17 GDPR does not change the findings of the 
Costeja judgement, in which the CJEU held that a request for delisting was based on the Right to 
rectification/erasure and on the Right to object, pursuant to Article 12 and Article 14 of the Directive 
respectively. 


Article 17.1 sets out a general principle to erase the data in the six following cases: 


a. the personal data are no longer necessary in relation to the purposes for which they were 
collected or otherwise processed (Article 17.1.a); 

b. the data subject withdraws consent on which the processing is based (Article 17.1.b); 
the data subject exercised his or her Right to object to processing of his or her personal data 
pursuant to Article 21.1 and 21.2 GDPR; 
the personal data have been unlawfully processed (Article 17.1.d); 
the erasure is compliant with a legal obligation (Article 17.1.e); 

f. the personal data have been collected in relation to the offer of information society services 
to a minor (Article 17.1.f which refers to Article 8.1). 


While all the grounds of Article 17 are theoretically applicable when it comes to delisting, in practice, 
some will be rarely or never used, such as in case of withdrawal of consent (see ground 2 below). 


A data subject could however make a delisting request to a search engine provider based on more than 
one ground. For example, a data subject could request delisting because he or she considers it no 





7 Regulation 2016/679 (GDPR), Article 17.2: “Where the controller has made the personal data public and is obliged pursuant 
to paragraph 1 to erase the personal data, the controller, taking account of available technology and the cost of 
implementation, shall take reasonable steps, including technical measures, to inform controllers which are processing the 
personal data that the data subject has requested the erasure by such controllers of any links to, or copy or replication of, 
those data.” 

8 See CJEU, Case C-136/17, GC and Others v CNIL, judgment of 24 September 2019, paragraph 35 and Case C-131/12, 
judgment of 13 May 2014, paragraph 41. 

9 Article 29 Data Protection Working Party, “Guidelines on the implementation of the Court of Justice of the European Union 
judgment on “Google Spain and inc v. Agencia Española de Protección de Datos (AEPD) and Mario Costeja Gonzalez” C- 
131/12, WP 225, 26 November 2014, p. 23. 
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longer necessary that his or her personal data are processed by the search engine (Article 17.1.a) and 
also exercise his or her Right to object to the processing pursuant to Article 21.1 GDPR (Article 17.1.c). 


In order for Supervisory Authorities to assess complaints regarding a search engine provider who has 
refused to erase a particular search result pursuant to Article 17 GDPR, Supervisory Authorities should 
establish whether the content to which an URL is referring to should be delisted or not. They should 
thus, in their analysis of the substance of the complaint, take into account the nature of the content 
made available by the publishers of the third-party websites. 


1.1 Ground 1: The Right to request delisting when the personal data are no longer 
necessary in relation to the search engine provider’s processing (Article 17.1.a) 


According to Article 17.1.4 GDPR, a data subject may request a search engine provider, following a 
search carried out as a general rule on the basis of his or her name, to delist content from its search 
results, where the data subject’s personal data returned in those search results are no longer necessary 
in relation to the purposes of the processing by the search engine. 


This provision enables a data subject to request the delisting of personal information concerning him 
or her that have been made accessible for longer than it is necessary for the search engine provider’s 
processing. Yet, this processing is notably carried out for the purposes of making information more 
easily accessible for internet users. Within the context of the Right to request delisting, the balance 
between the protection of privacy and the interests of Internet users in accessing the information must 
be undertaken. In particular, it must be assessed whether or not, over the course of time, the personal 
data have become out-of-date or have not been updated. 


For example, a data subject may exercise his or her Right to request delisting pursuant to Article 17.1.a 
when: 


= information about him or her held by a company has been removed from the public register; 

= a link to a firm’s website contains his or her contact details although he or she is no longer 
working in that firm; 

= information has to be published on the Internet for a number of years to meet a legal 
obligation and remained online longer than the time limit specified by the legislation. 


As demonstrated by the examples, a data subject may notably request the delisting of a content where 
the personal information are obviously inaccurate due to the course of time, or outdated. Such an 
assessment will incidentally be dependent on the purposes of the original processing. Consequently, 
the original retention periods of personal data, when available, should also be considered by 
Supervisory Authorities when they conduct their analysis of delisting requests pursuant to Article 
17.1.a GDPR. 


1.2 Ground 2: The Right to request delisting when the data subject withdraws 
consent where the legal basis for the processing is pursuant to Article 6.1.a or 
Article 9.2.a GDPR and where there is no other legal basis for the processing 
(Article 17.1.b) 


According to Article 17.1.6 GDPR, a data subject may obtain the erasure of personal data concerning 
him or her where he or she withdraws consent for the processing. 


In case of delisting, it would mean that the search engine provider would have utilised the consent of 
the data subject as lawful basis for its processing. Article 17.1 GDPR indeed raises the question of the 
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lawful basis for processing relied upon by a search engine provider for the purpose of returning search 
engine results including personal data. 


For that reason, it appears unlikely that a delisting request would be submitted by a data subject on 
the basis that he or she wishes to withdraw consent because the controller to whom the data subject 
gave his or her consent is the web publisher, not the search engine operator that indexes the data. 
This interpretation has been endorsed by the CJEU in its judgement C-136-17 of 24 September 2019 
(the “Google 2 judgment”).*° The Court indicates that “(...) the consent must be ‘specific’ and must 
therefore relate specifically to the processing carried out in connection with the activity of the search 
engine (...). In practice, it is scarcely conceivable (...) that the operator of a search engine will seek the 
express consent of data subjects before processing personal data concerning them for the purposes of 
his referencing activity. In any event, (...) the mere fact that a person makes a request for de-referencing 
means, in principle, at least at the time of making the request, that he or she no longer consents to the 
processing carried out by the operator of the search engine.” 


Nonetheless, in the event where a data subject would have withdrawn his or her consent for the use 
of his or her data on a particular web page, the original publisher of that web page should inform 
search engine providers who have indexed that data pursuant to Article 17.2 GDPR. The data subject 
would thus still be entitled to obtain the delisting of personal data concerning him or her but according 
to Article 17.1.c in such case. 


1.3 Ground 3: The Right to request delisting when the data subject has exercised his 
or her Right to object to the processing of his or her personal data (Article 17.1.c) 


Pursuant to Article 17.1.c GDPR, a data subject can obtain from the search engine provider the erasure 
of personal data concerning him or her where he or she objects to the processing according to Article 
21.1 GDPR and where there are no overriding legitimate grounds for the processing by the data 
controller. 


The Right to object affords stronger safeguards to data subjects since it does not restrict the grounds 
according to which data subjects may request delisting as under Article 17.1 GDPR. 


The Right to object to the processing was provided for by Article 14 of the Directive? and constituted 
a ground to request the delisting since the Costeja judgement. However, the differences in the wording 
of Article 21 GDPR and Article 14 of the Directive suggest that there may also be differences in their 
application. 


Under the Directive, the data subject had to base his or her request “on compelling legitimate grounds 
relating to his [or her] particular situation”. In respect of the GDPR, a data subject can object to a 
processing “on grounds relating to his or her particular situation”. He or she thus no longer has to 
demonstrate “compelling legitimate grounds”. 


The GDPR therefore changes the burden of proof, providing a presumption in favour of the data subject 
by obliging on the contrary the controller to demonstrate “compelling legitimate grounds for the 
processing” (Article 21.1). As a result, when a search engine provider receives a request to delist based 
on the data subject’s particular situation, it must now erase the personal data, pursuant to Article 





10 CJEU, Case C-136/17, Commission nationale de l'informatique et des libertés (CNIL) v. Google LLC, judgment of 24 
September 2019. 

11 Directive 95/46/CE, Article 14: “Member States shall grant the data subject the right: (a) at least in the cases referred to in 
Article 7 (e) and (f), to object at any time on compelling legitimate grounds relating to his particular situation to the processing 
of data relating to him, save where otherwise provided by national legislation. Where there is a justified objection, the 
processing instigated by the controller may no longer involve those data” 
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17.1.c GDPR, unless it can demonstrate “overriding legitimate grounds” for the listing of the specific 
search result, which read in conjunction with Article 21.1 are “compelling legitimate grounds (...) which 
override the interests, rights and freedoms of the data subject”. The search engine provider can 
establish any “overriding legitimate grounds”, including any exemption provided for under Article 17.3 
GDPR. Nonetheless, if the search engine provider fails to demonstrate the existence of overriding 
legitimate grounds, the data subject is entitled to obtain the delisting pursuant to Article 17.1.c GDPR. 
As a matter of fact, delisting requests now imply to make the balance between the reasons related to 
the particular situation of the data subject and the compelling legitimate grounds of the search engine 
provider. The balance between the protection of privacy and the interests of Internet users in accessing 
to the information as ruled by the CJEU in the Costeja judgement can be relevant to conduct such 
assessment, as well as the balance operated by the European Court of Human Rights (ECHR) in press 
matters. 


Therefore, the criteria of delisting developed by the Article 29 Working Party in guidelines on the 
implementation of the Court of Justice of the European Union judgment on “Google Spain and Inc v. 
Agencia Española de Protección de Datos (AEPD) and Mario Costeja Gonzalez” C-131/12 can still be 
used by search engine providers and Supervisory Authorities to assess a delisting request based on the 
Right to object (Article 17.1.c GDPR). 


In this regard, the “particular situation” of the data subject will underlie the delisting request (for 
example, a search result creates detriment for a data subject when applying for jobs, or undermines 
his or her reputation in personal life) and will be taken into account when undertaking the balance 
between personal rights and right to information, in addition to the classic criteria for handling 
delisting requests, such as: 


= he or she does not play a role in public life; 

= the information at stake is not related to his or her professional life but affects his or her 
privacy; 

= the information constitutes hate speech, slander, libel or similar offences in the area of 
expression against him or her pursuant to a court order; 

= the data appears to be a verified fact but is factually inaccurate; 

= the data relates to a relatively minor criminal offence that happened a long time ago and 
causes prejudice to the data subject. 


Nonetheless, these criteria won’t have to be examined in the absence of proof of compelling legitimate 
grounds to refuse the request. 


1.4 Ground 4: The Right to request delisting when the personal data have been 
unlawfully processed (Article 17.1.d) 


According to Article 17.1.d GDPR, a data subject may request the erasure of personal data concerning 
him or her in the instance where they have been unlawfully processed. 


The notion of unlawful processing shall first be interpreted in view of Article 6 GDPR dedicated to 
lawfulness of processing. Other principles established under the GDPR (such as principles of Article 5 
GDPR or of other provisions of Chapter II) may serve such interpretation. 


This notion shall secondly be interpreted broadly, as the infringement of a legal provision other than 
the GDPR. Such interpretation must be conducted objectively by Supervisory Authorities, according to 
national laws or to a court decision. For instance, a delisting request shall be granted in the event 
where the listing of personal information has been expressly prohibited by a court order. 
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In cases where a search engine provider is not able to demonstrate a legal basis for its processing, a 
delisting request may fall under the scope of art 17.1.d GDPR, as the processing of personal data in 
such cases must be considered unlawful. Nonetheless, it must be reminded that in case of unlawfulness 
of the original processing, the data subject remains entitled to request delisting under Article 17.1.c 
GDPR. 


1.5 Ground 5: The Right to request delisting when the personal data have to be 
erased for compliance with a legal obligation (Article 17.1.e) 


According to Article 17.1.e GDPR, a data subject may request a search engine provider to delist one or 
more search results if the personal data need to be erased in compliance with a legal obligation in 
Union or Member State Law to which the search engine provider is subject. 


Compliance with a legal obligation may result from an injunction, an express request by national or EU 
law for being under a “legal obligation to erase” or the mere breach by the search engine provider of 
the retention period. For illustrative purposes, the retention period of data is set by a text but would 
not be complied with (but this hypothesis mainly concerns public files). This case could maybe 
encompass the hypothesis of non-anonymized or identifying data available in open data. 


1.6 Ground 6: The Right to request delisting when the personal data have been 
collected in relation to the offer of information society services (ISS) to a child 
(Article 17.1.f) 


According to Article 17.1.f GDPR, a data subject may request a search engine provider to delist one or 
more results if personal data have been collected in relation to the offer of ISS to a child referred to in 
Article 8.1 GDPR. 


The Article covers the direct provision of ISS and no other types of processing. The GDPR does not 
define ISS; rather, it refers to existing definitions in EU law!. There are some difficulties in 
interpretation as Recital 18 of Directive 2000/31/CE of the European Parliament and of the Council of 
June 8, 2000 provides a definition both broad and ambiguous of the notion of “the direct provision of 
information society services”. It mainly indicates that these services “span a wide range of economic 
activities which take place on-line”, but specifies that they are not restricted to “services giving rise to 
on-line contracting but also, in so far as they represent an economic activity, extend to services which 
are not remunerated by those who receive them, such as those offering on-line information or 
commercial communications, or those providing tools allowing for search, access and retrieval of data”, 
outlining the criteria of economic activity. 


It stems from the above that search engine providers’ activities are likely to fall within the scope of 
direct provision of ISS. Nonetheless, search engine providers do not question whether the personal 
data they are indexing concern or not a child. Yet, in view of their specific responsibilities, and subject 
to the application of Article 17.3 GDPR, they would have to delist a content relating to a child pursuant 
to Article 17.1.c GDPR, acknowledging that being a child is a valid “ground relating to a particular 
situation” (Article 21 GDPR) and that “children merit specific protection with regard to their personal 
data” (Recital 38 GDPR). In such case, the context of the collection of personal data by the original 


12 Specifically, Article 1(1)(b) of Directive (EU) 2015/1535 of the European Parliament and of the Council of 9 September 2015 
laying down a procedure for the provision of information in the field of technical regulations and of rules on Information 
Society services (codification). 
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controller must be considered. In particular, the date of the beginning of the processing by the original 
website must be taken into account when a data subject requests the delisting of a content. 


2 THE EXCEPTIONS TO THE RIGHT TO REQUEST DELISTING UNDER 
ARTICLE 17.3 


Article 17.3 GDPR states that paragraphs 1 and 2 of Article 17 GDPR will not apply when processing is 
necessary: 


a. for exercising the right of freedom of expression and information (Article 17.3.a); 

b. for compliance with a legal obligation that requires processing by Union or Member State law 
to which the controller is subject or for the performance of a task carried out in the public 
interest or in the exercise of official authority vested in the controller (Article 17.3.b); 

c. for reasons of public interest in the area of public health in accordance with points (h) and (i) 
of Article 9.2 as well as Article 9.3 (Article 17.3.c); 

d. for archiving purposes in the public interest, scientific or historical research purposes, or 
statistical purposes in accordance with Article 89 (1) in so far as the right referred to in 
paragraph 1 is likely to render impossible or seriously impair the achievement of the objectives 
of that processing (Article 17.3.d); or 

e. for the establishment, exercise or defense of legal claims (Article 17.3.e). 


This part aims to demonstrate that most of the exceptions under Article 17.3 GDPR do not appear 
suitable in case of a delisting request. Such inadequacy pleads in favor of the application of Article 21 
GDPR for delisting requests. In any event, it must be remembered that exceptions provided for under 
Article 17.3 GDPR can be invoked as compelling legitimate grounds pursuant to Article 17.1.c GDPR. 


2.1 Processing is necessary for exercising the right of freedom of expression and 
information 


This exemption to the application of Article 17.1 GDPR must be interpreted and applied in the context 
of the characteristics that define erasure. Article 17.1 GDPR is described as a clear and unconditional 
mandate addressed to controllers. If the conditions set forth in Article 17.1 GDPR are met, the 
controller shall "have the obligation to delete personal data without undue delay”. Nonetheless, this is 
not an absolute right. The exemptions of Article 17.3 GDPR identify cases in which this obligation does 
not apply. 


However, the balance between protecting the rights of interested parties and freedom of expression, 
including free access to information, is an intrinsic part of Article 17 GDPR. 


The CJEU recognised in the Costeja judgement and repeated recently in the Google 2 judgment that 
the processing carried out by a search engine provider can significantly affect the fundamental rights 
to privacy and data protection law when the search is performed using the name of a data subject. 


When weighing up the rights and freedoms of data subjects and the interests of Internet users in 
accessing the information through the search engine provider, the Court understood that "Whilst it is 
true that the data subject's rights are protected by those articles also override, as a general rule, that 
interest of internet users, that balance may however depend, in specific cases, on the nature of the 
information in question and its sensitivity for the data subject's private life and on the interest of the 
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public in having that information, an interest which may vary, in particular, according to the role played 
by the data subject in public life.” ® 


The Court also considered that the rights of the data subjects will prevail, in generalt, on the interest 


of Internet users in accessing information through the search engine provider. However, it identified 
several factors that may influence such determination. Among them include: the nature of the 
information or its sensitivity, and especially the interest of Internet users in accessing information, an 
interest that can vary depending on the role played by the interested party in public life. 


The analysis of the delisting by the Court implies that, when assessing requests for delisting, the 
decision on the maintenance or blocking of the search results by a search engine provider necessarily 
has to consider what would be the impact of a delisting decision on the access to information by 
Internet users. This impact does not necessarily entail the rejection of a delisting request. As 
confirmed by the Court, such interference with the fundamental rights of the data subject has to be 
justified by the preponderant interest of the general public in having access to the information in 
question. 


The Court also distinguished between the legitimacy that a web publisher can have to disseminate 
information against the legitimacy of the search engine provider. The Court recognised that the activity 
of a web publisher can be undertaken exclusively for the purposes of journalism, in which case the 
web publisher would benefit from the exemptions that Member States could establish in these cases 
on the basis of Article 9 of the Directive (currently , Article 85.2 GDPR). In this regard, in the judgment 
“M.L. and W.W. vs Germany” of June 28th, 2018, the ECHR indicates that the balancing of the interests 
at issue may lead to different results depending on the request at stake (distinguishing (i) a request for 
erasure brought against the original publisher whose activity is at the heart of what freedom of 
expression aims to protect from (ii) a request brought against the search engine whose first interest is 
not to publish the original information on the data subject but notably to enable identifying any 
available information on this person and thus establishing his or her profile). 


Those considerations should be assessed in respect of Article 17 GDPR complaints as in those decisions, 
the rights of the data subjects that have requested the delisting must be weighed with the interests of 
Internet users to access the information. 


As explained by the CJEU in its Google 2 judgment, Article 17.3.a GDPR is “an expression of the fact 
that the right to protection of personal data is not an absolute right but (...) must be considered in 
relation to its function in society and be balanced against other fundamental rights, in accordance with 
the principle of proportionality”.*® It “expressly lays down the requirement to strike a balance between 
the fundamental rights to privacy and protection of personal data guaranteed by Articles 7 and 8 of 
the Charter, on the one hand, and the fundamental right of freedom of information guaranteed by 
Article 11 of the Charter, on the other.”?” 


The Court concludes that "where the operator of a search engine has received a request for de- 
referencing relating to a link to a web page on which personal data falling within the special categories 
(...), the operator must, on the basis of all the relevant factors of the particular case and taking into 
account the seriousness of the interference with the data subject’s fundamental rights to privacy and 





13 CJEU, C-131/12, judgment of 13 May 2014, paragraph 81; CJEU, C-136/17, judgment of 24 September 2019, paragraph 66. 
14 CJEU, Case C-131/12, judgment of 13 May 2014, paragraph 99; CJEU, Case C-136/17, judgment of 24 September 2019, 
paragraph 53. 

15 CJEU, Case C-136/17, judgment of 24 September 2019, paragraph 56 et seq. 

16 CJEU, Case C-136/17, judgment of 24 September 2019, paragraph 57. 

17 CJEU, Case C-136/17, judgment of 24 September 2019, paragraph 59. 
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protection of personal data laid down in Articles 7 and 8 of the Charter, ascertain, having regard to the 
reasons of substantial public interest (...), whether the inclusion of that link in the list of results displayed 
following a search on the basis of the data subject’s name is strictly necessary for protecting the 
freedom of information of internet users potentially interested in accessing that web page by means of 
such a search, protected by Article 11 of the Charter.”*® 


To conclude, depending on the circumstances of the case, search engine providers may refuse to delist 
a content in the event where they can demonstrate that its inclusion in the list of results is strictly 
necessary for protecting the freedom of information of internet users. 


2.2 Processing is necessary for compliance with a legal obligation to which the 
controller is subject or for the performance of a task carried out in the public 
interest or in the exercise of official authority vested in the controller 


The content of this exemption makes it difficult to apply to the activity of search engine providers and 
it may have influence on the decisions of delisting certain results, as the processing of data by search 
engine providers is based, in principle, on the legitimate interest of the search engine provider. 


2.2.1 Legal obligation 


It is difficult to imagine the existence of legal provisions that oblige search engine providers to 
disseminate certain information. This is a consequence of the type of activity they develop. Search 
engine providers do not produce or present information. 


Therefore, it seems unlikely that Member State law includes obligations for search engine providers to 
publish some type of information, instead of setting the obligation for that publication to be carried 
out in other web pages that will then be linked by search engine providers. 


This assessment may also be extended to the possibility that Union or Member State law enables a 
public authority to take decisions that oblige search engine providers to publish information directly, 
and not through the URL links to the web page where that information is contained. 


If there are cases in which the law of a Member State establishes the obligation for the search engine 
providers to publish decisions or documents containing personal information, or which authorises 
public authorities to demand such publication, the exemption contained in Article 17.3.6 GDPR should 
be applied. 


This application must take into account the terms in which it is established, that is, that the 
maintenance of the information in questions is necessary to meet the legal obligation of publication. 
For example, that a legal obligation, or the decision of an authority legally entitled to adopt it, may 
include a time limit to the publication, or expressly stated purposes that may have been reached within 
a certain time period. In these cases, if the request for delisting occurs having exceeded these time 
limits, it should be considered that the exemption is no longer applicable. 


On the contrary, it is frequent that Member State law provides for the publication on web pages of 
information containing personal data. That legal obligation to publish or maintain the published 
information cannot be considered as covered by the exemption contained in Article 17.3.b GDPR, since 
it is not directed to the search engine provider, but to the web publishers whose content is linked by 





18 CJEU, Case C-136/17, judgment of 24 September 2019, paragraph 69. 
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the search engine provider’s index. Therefore, the search engine provider cannot invoke the existence 
of the obligation to reject a request for delisting. 


However, the legal obligation of publication addressed to other web publishers should be taken into 
consideration when establishing the balance between the rights of data subjects and the interest of 
the Internet users in accessing the information. The fact that information must be published online by 
legal mandate, or following the decision of an authority legally entitled to adopt it, is indicative of an 
interest in the public being able to access that information. 


That presumption of existence of a prevalent interest of the public does not operate in the same way 
in respect of the originating web pages compared to the results index of a search engine provider. 
Although the legal obligation to publish information on a certain web site may lead to the conclusion 
that this information should not be deleted from that web page, the decision regarding the results 
offered by the search engine provider when the name of a data subject is generally used as search 
term may be different. 


The assessment of the request for delisting in these cases should not assume that the existence of the 
legal obligation of publication necessarily implies that, to the extent that this obligation is imposed on 
the original web publishers, it is not possible to accept the delisting by the search engine provider. 


The decision should be taken, as is the general rule, by balancing the rights of the data subject and the 
interest of the Internet users to access this information through the search engine provider. 


2.2.2 Performance of a task carried out in public interest or in the exercise of official 
authority 


Search engine providers are not public authorities and therefore do not exercise public powers by 
themselves. 


However, they could exercise those powers if they were attributed by the law of a Member State or of 
the Union. In the same way that they could carry out missions of public interest if their activity was 
considered necessary to satisfy that public interest in accordance with national legislation’’. 


Given the characteristics of search engine providers, it is unlikely that Member States will grant them 
public powers or consider that their activity or part of it is necessary for the achievement of a legally 
established public interest. 


If, in spite of that, there is a case in which the law of the Member States grants search engines public 
powers or links their activity to the achievement of a public interest, they could avail of the exemption 
provided for in Article 17.3.6 GDPR. The considerations previously made on the cases in which the law 
of a Member State had established a legal obligation to process information for search engine 
providers are also valid in this case. 


To decide not to follow a delisting request for reasons related to this exemption, it is necessary to 
determine whether the maintenance of the information in the search engine results is necessary for 
the achievement of the public interest pursued or for the exercise of the powers of attorney. 


On the other hand, the legal definition of powers or public interest would be carried out by a Member 
State, and if the search engine rejects a request for delisting on the basis of this exemption, it must 


19 GDPR, Article 6.3: “The basis for the processing referred to in point (c) and (e) of paragraph 1 shall be laid down by: 
(a) Union law; or 
(b) Member State law to which the controller is subject (...)” 
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also be understood that it does so because it considers that its activity is necessary to achieve public 
interests. The search engine provider should, in that event, provide reasons why it considers its activity 
to be carried out in the public interest. Without such an explanation, the denial to follow a data 
subject’s delisting request does not have the possibility of relying on the exemption. 


Consequently, it would also be the Supervisory Authority of the Member State whose law is applicable 
that will have to deal with a potential complaint pursuant to Article 55.2 GDPR. 


2.3 Reasons of public interest in the area of public health 


This exemption is a specific case based on the fact that processing is necessary for the performance of 
a public interest. 


In this case, the public interest is limited to the area of public health, but, as with the public interest in 
any other area, the lawful basis for the processing must be established in Union law or Member State 
law. 


From the point of view of the application of this exemption in the context of the activity of the search 
engine provider, the same conclusions as stated above can be reached. It does not seem likely that the 
law of a Member State or of the Union can establish a relationship between the activity of the search 
engine provider and the maintenance of information or of a category of information in the results of 
the search engine provider with the achievement of purposes of public interest in respect of public 
health. 


This conclusion is more evident if one takes into account that the effect of delisting is only that some 
results are deleted from the results page that is obtained when mainly a name is entered as a search 
criterion. But the information is not deleted from the search engine providers’ indexes and can be 
retrieved using other search terms. 


It is, therefore, difficult to imagine that keeping those results visible when searches are mainly made 
on the basis of a data subject's name can be considered, in general, as something necessary for reasons 
of public interest in the area of public health. 


The criteria on the applicability of national standards and the identification of the Supervisory 
Authority that must deal with possible claims in a case relating to Article 17 GDPR that was rejected 
using this exemption have been discussed above. 


2.4 Archiving purposes in the public interest, scientific or historical research 
purposes, or statistical purposes in accordance with Article 89 (1) in so far as the 
Right referred to in paragraph 1 is likely to render impossible or seriously impair 
the achievement of the objectives of that processing 


In this scenario, the search engine provider must be able to demonstrate that the delisting of a certain 
content on the results page is a serious obstacle or completely prevents the achievement of scientific 
or historical research purposes or statistical purposes. 


It should be understood that these purposes must be objectively pursued by the search engine 
provider. The possibility that the suppression of results could significantly affect research purposes or 
statistical purposes pursued by users of the search engine provider’s service is not relevant for the 
application of this exemption. Those purposes, if they exist, should be taken into consideration when 
establishing a balance between the rights of the data subject and the interests of the Internet users in 
accessing the information through the search engine provider. 
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It must also be noted that these purposes may be objectively pursued by the search engine provider, 
without a link between in principle the name of the data subject and the search results being 
necessary. 


2.5 Establishment, exercise or defence of legal claims 


In principle, it is very unlikely that search engine providers can use this exemption to reject Article 17 
GDPR delisting requests. 


It must be further emphasised that a delisting request supposes the suppression of certain results from 
the search results page provided by the search engine provider when the name of a data subject is 
normally used as search criteria. The information remains accessible using other search terms. 
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